4 ms·
I kinda wish we stopped fixing these for consumer OSes. People don't usually run untrusted code for hours. The performance drop isn't worth the result. So, IMO,
by grishka 6y ago
I kinda wish we stopped fixing these for consumer OSes. People don't usually run untrusted code for hours. The performance drop isn't worth the result. So, IMO, it's only really applicable to cloud providers.
- corty 6y agoPeople regularly run untrusted Javascript in their browsers. Spectre is exploitable via Javascript as well. There are some mitigations, but those are generally just of the kind "make the timer API suck more" and the likes. Those mitigations don't really fully mitigate the problem and get more and more toothless with new variants of Spectre-like problems. Spectre and the like needs to be dealt with on everything that isn't strictly an embedded fixed-code device.
- grishka 6y agoIs it reliably exploitable from JS, or is it again a theoretical thing nobody has ever bothered to implement in practice? Is there a web page that would show me some of my kernel memory?
- JeremyBanks 6y agoIt's only theoretical until we discover that some state agency got it working three years ago and has been using it to quietly pwn activists since.
- bretthoerner 6y agohttps://leaky.page/ https://leaky.page/
- deleted 6y ago[deleted]
- saddlerustle 6y agohttps://leaky.page/ https://leaky.page/ will show you browser memory. Kernel memory is not vulnerable with browser sandboxing and current mitigations.
- grishka 6y agoThe two tests do work for me, but the actual leaking doesn't. No matter how I tweak the parameters, it fails with "error: too many wrong false negatives in leak test (> 20%)". I guess my CPU might just be too old ¯\_(ツ)_/¯
- azepoi 6y agoIs it possible to put these mitigations for Javascript only in the browser?
- kevingadd 6y agoSome mitigations are implemented by browsers, but a lot of it has to happen at the OS level
- saddlerustle 6y agoFirefox doesn't yet, but Chrome on desktop fully mitigates spectre using site isolation - every origin (including via embedded iframes, etc) runs in its own process.
- throwaway823882 6y agoFwiw, every time Chrome claims to fix a security problem their own way, somebody finds an exploit in it later.
- zinekeller 6y ago> Chrome on desktop fully mitigates spectre using site isolation Spectre and pals can literally jump between processes that it's no longer funny.
- deleted 6y ago[deleted]
- saddlerustle 6y agoRealistically, only processes that are scheduled on sibling hyperthreads, and hyperthreading can be restricted to processes that have the same privilege level, which is done on ChromeOS. The amount of microarchetectural state that sticks around after a context switch is finite and whenever there's a new avenue found like this, usually easily fixed by ucode update and kernel fix.
- corty 6y ago> easily fixed by ucode update and kernel fix Those microcode updates and kernel fixes are anything but easy. They are anything but lightweight. Context switching overhead is a huge contributor to lag and general inefficiency in interactive systems. Every kind of Spectre mitigation increases that overhead. Every further mitigation wrecks more of the performance advantages that caches have historically provided. From a performance, power consumption and efficiency perspective, Spectre is a disaster. Mitigations just move the problem from a security and privacy one to an efficiency and performance one.
- jeltz 6y agoI will happily sacrifice some performance to be able to run JavaScript, WebAssembly, virtual machines and Docker containers safely on my laptop.
- jart 6y agoWeb browsers do. Especially with v8 JIT, ASM.JS, WebAssembly. People have used it in the past to do things like write HTML pages that reach all the way down, across the browser, across docker, across gvisor, across selinux, across the operating system, across the hypervisor, and reprograms your CPU microcode. https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-koppe.pdf https://www.usenix.org/system/files/conference/usenixsecurit... I kind of wish browsers provided us the freedom to turn all those wasm jit optimizations off, for that reason. Does anyone know how to write a browser extension that does it? If you want something that should be done for consumer machines, push for ECC RAM.
- saddlerustle 6y agoThat hasn't happened. That paper describes the potential for backdoored microcode, not any existing vulnerabilities that can be triggered from an unprivileged state.
- xioxox 6y agoYou also have to always wonder what the environmental impact of these security fixes is, both in terms of extra carbon pumped into the atmosphere and the resources going into replacement CPUs. It's probably very bad. I wonder whether it's ethical to publish them? :)
- gmueckl 6y agoThat seems reasonable to me. For especially paranoid people (like some of the HN crowd), you could design a "safe" computer within a computer that takes all the performance hits from in-order cache-less designs and has two very controlled communication channels with the rest of the system: one for bidirectional data transfers to the main CPU and an unidirectional one to stream (software-rendered?) framebuffer data to the GPU. I highly doubt that the market is big enough to make such a product viable.